[JSC] Add ArrayJoin DFG nodes

26b192b

JSC's DFG is the mid-tier JIT compiler; operations are nodes in a graph. Adding ArrayJoin as a node means the compiler emits native code for Array#join instead of dispatching to a generic C++ runtime. ArrayMode encodes observed storage types (Int32, Double, Contiguous, Generic). The critical correctness invariant is that a separator object's toString() side effect must run exactly once per join() call, even when an array mutation inside toString() triggers an OSR exit — because the bytecode slow path will call toString() again if the JIT already ran it.

The commit's regression tests encode this directly: object separators whose toString() mutates the array (length shrink, indexing-type swap) must produce identical output across all tiers, with calls === testLoopCount.

Significance

New JIT intrinsics with side-effect-sensitive invariants across OSR exit boundaries are historically one of the richest categories of JIT vulnerability.

Audit directions